diff options
| author | Steven Rostedt (Red Hat) <rostedt@goodmis.org> | 2014-11-14 20:49:41 (GMT) |
|---|---|---|
| committer | Steven Rostedt <rostedt@goodmis.org> | 2014-11-20 03:01:15 (GMT) |
| commit | 5ac48378414dccca735897c4d7f4e19987c8977c (patch) | |
| tree | 9cf5c11dddd8081327d7e7f8a68a9e47613adcfa /kernel/trace/trace_events.c | |
| parent | 74f06bb72347302a19aac087314388ebd0e4fee9 (diff) | |
| download | linux-5ac48378414dccca735897c4d7f4e19987c8977c.tar.xz | |
tracing: Use trace_seq_used() and seq_buf_used() instead of len
As the seq_buf->len will soon be +1 size when there's an overflow, we
must use trace_seq_used() or seq_buf_used() methods to get the real
length. This will prevent buffer overflow issues if just the len
of the seq_buf descriptor is used to copy memory.
Link: http://lkml.kernel.org/r/20141114121911.09ba3d38@gandalf.local.home
Reported-by: Petr Mladek <pmladek@suse.cz>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Diffstat (limited to 'kernel/trace/trace_events.c')
| -rw-r--r-- | kernel/trace/trace_events.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 4d0067d..935cbea 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -1044,7 +1044,8 @@ event_filter_read(struct file *filp, char __user *ubuf, size_t cnt, mutex_unlock(&event_mutex); if (file) - r = simple_read_from_buffer(ubuf, cnt, ppos, s->buffer, s->seq.len); + r = simple_read_from_buffer(ubuf, cnt, ppos, + s->buffer, trace_seq_used(s)); kfree(s); @@ -1210,7 +1211,8 @@ subsystem_filter_read(struct file *filp, char __user *ubuf, size_t cnt, trace_seq_init(s); print_subsystem_event_filter(system, s); - r = simple_read_from_buffer(ubuf, cnt, ppos, s->buffer, s->seq.len); + r = simple_read_from_buffer(ubuf, cnt, ppos, + s->buffer, trace_seq_used(s)); kfree(s); @@ -1265,7 +1267,8 @@ show_header(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos) trace_seq_init(s); func(s); - r = simple_read_from_buffer(ubuf, cnt, ppos, s->buffer, s->seq.len); + r = simple_read_from_buffer(ubuf, cnt, ppos, + s->buffer, trace_seq_used(s)); kfree(s); |